Windows kiosk auto logon with a domain user after a scheduled reboot

Can a Windows kiosk sign in as a domain user and recover from a reboot?

Yes. Give each screen its own restricted domain account, switch on Windows automatic logon with the four Winlogon registry values Microsoft documents, start the browser in kiosk mode at sign-in, and let a scheduled 04:00 reboot bring the whole session back on its own.

Automatic logon is the piece that keeps the domain context. The Windows Settings kiosk wizard offers local accounts, and whether it lists your on-premises domain account depends on edition and version. The registry path below works on any domain-joined PC, so it is the route to use when the page demands a domain sign-in. After each reboot the chain is short: boot, automatic sign-in, Startup shortcut, dashboard. Nothing in the chain needs a person at the screen.

What do you need before you start?

You need one domain-joined Windows PC per screen (15 PCs for 15 screens), one dedicated kiosk account per PC, the report URL that PC shows, and an administrator sign-in for the one-time setup.

• Windows 10 or 11 Pro, Enterprise or Education on every PC; the kiosk features are not in Home.
• One domain account per screen, password set to never expire, allowed workstations limited to its one PC.
• The report URL for each screen, exactly as it opens on your desk.
• Administrator rights on the PCs for the setup session.
• A reboot window outside production; this article uses 04:00.

How do you create a kiosk account for each screen?

Create one domain account per screen, named for its location, and strip it down to browser rights. It needs no admin role, no Remote Desktop right and no share access, because its only job is to hold a signed-in session for one dashboard.

1. In your directory admin console, create one account per screen and name it for the place the screen hangs. At 04:05 a name like that points at one PC, not at a mystery.
2. Set the password to never expire. If policy forbids that, own a rotation date and update DefaultPassword on all 15 PCs the same day.
3. Keep the account out of every admin group. No Remote Desktop, no access to shares beyond what the dashboard itself needs.
4. Restrict the account's allowed workstations to its one PC. An interactive sign-in with that password then works only where the screen hangs.

Which registry values switch on automatic domain logon?

Four string values under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon switch it on: AutoAdminLogon set to 1, DefaultUserName and DefaultDomainName set to the kiosk account, and DefaultPassword set to that account's password, so the PC signs itself in as a real domain user at every boot.

1. Sign in as administrator and open regedit.
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
3. Set AutoAdminLogon to 1, as a string value.
4. Set DefaultUserName to the kiosk account name and DefaultDomainName to the domain as you type it at the login screen.
5. Create DefaultPassword as a string and enter the account's password.

Microsoft's automatic logon walkthrough documents these values, and it says the password sits in the registry as plain text. That is the reason for the restricted account in the previous section: one PC, one dashboard, no admin rights, nothing else to reach. The same walkthrough links a helper that stores the password encrypted instead, if plain text on 15 PCs is more than your security team accepts.

How does the dashboard start in kiosk mode after sign-in?

Put a shortcut in the kiosk account's Startup folder that starts the browser with the --kiosk flag and the report URL. The dashboard fills the screen within seconds of sign-in, with no address bar for anyone to type into.

1. Sign in once as the kiosk account and run whoami in a command prompt. It should print your domain and the account name; if it prints a local name, the logon values in the previous section are wrong.
2. Press Win+R, type shell:startup and press Enter. That opens this account's Startup folder.
3. Create a shortcut with the target msedge.exe --kiosk "https://reports.internal/line1", where the address is the same one the report opens under on your desk. For Chrome, the same target works with chrome.exe.
4. Sign out, sign back in as the kiosk account, and confirm the report fills the screen.

Edge has a documented kiosk mode of its own; Microsoft's Edge kiosk mode configuration guide covers the Settings route for the same result. One PC feeding two screens changes only the browser side; Chrome kiosk mode on two monitors for a web HMI covers that layout.

When should a kiosk PC reboot, and what happens after it?

Schedule the reboot with Task Scheduler at 04:00, before the shift starts, running shutdown.exe with /r /t 0. Automatic logon signs the account back in so the Startup shortcut reloads the dashboard with nobody standing in front of the screen.

1. Open Task Scheduler and create a task.
2. Trigger: daily at 04:00.
3. Action: start a program, shutdown.exe, arguments /r /t 0.
4. Run the task as SYSTEM so it fires no matter which account holds the session.

From the restart, the chain runs without anyone: boot, automatic logon signs the kiosk account in, the Startup shortcut opens the browser in kiosk mode, and the report server sees a domain user. Dark time is the boot itself, a few minutes on a mini PC.

Recommendation: Give each of the 15 screens its own restricted domain account, set the four Winlogon values, start the browser with --kiosk from the Startup folder, and reboot daily at 04:00 for the first week. Once all 15 come back on their own for seven mornings in a row, move the task to a weekly 04:00 restart. If the report server can serve the dashboard without domain credentials, skip the accounts and the stored password entirely.

How do you check that 15 screens come back on their own?

Reboot one screen by hand before you roll the schedule out to all 15. Judge it with a 5-minute rule: if the dashboard is not back on screen within 5 minutes of the restart, something in the logon or launch chain failed.

1. Sign in as the kiosk account by hand once; the report must fill the screen.
2. Restart that PC and time it. Back within 5 minutes.
3. Let the 04:00 task run on all 15 and look at 04:05. Any screen still dark failed the rule.

What each failure points to:

• A login mask instead of the dashboard: automatic logon did not fire, so check AutoAdminLogon is 1 and that DefaultPassword matches the account's current password. A login mask that belongs to the dashboard page itself has its own walkthrough, the kiosk auto-login login-mask fix.
• A desktop with a taskbar: the --kiosk flag never reached the browser, so fix the shortcut target.
• A dark screen 5 minutes on: the password changed or expired; sign in by hand once and update DefaultPassword.
• Old numbers on screen: the refresh belongs to the report, not to the kiosk setup, so set it on the report side.

Worked example: what does the setup look like on 15 screens?

A plant with 15 screens across three production lines needs 15 kiosk accounts and 15 registry edits of four values each. Add one scheduled task per PC at 04:00, and the result is that every screen re-signs itself and reloads its report without a single manual login.

• Accounts: 15, one per screen, each limited to its own PC.
• Registry: 4 values per PC, so 15 x 4 = 60 values to set at first install.
• Tasks: 15, each triggering daily at 04:00 and running shutdown.exe /r /t 0 as SYSTEM.
• Timeline: assume a mini PC takes 3 minutes from power-on to a signed-in kiosk screen. The 04:00 reboot shows fresh data by about 04:03, and a 05:00 shift start leaves 57 minutes of margin.
• Result: after any reboot, manual sign-ins across 15 screens: zero.
• Check: at 04:05 all 15 pages are up; any screen still dark failed the 5-minute rule in the previous section.

When is a domain kiosk the wrong setup?

If the report server can serve that dashboard without a domain sign-in, skip the accounts entirely. A kiosk browser on a plain local account, or an offline player, does the same job with no password stored anywhere.

Two easy cases. If IT can publish a read-only copy of the dashboard to the plant network, the Windows Settings route locks the browser to one page: open Windows Settings, type kiosk in the search field, and select Set up a kiosk (assigned access). Microsoft's assigned access overview explains the single-app and multi-app setups. If the screen does not need the live page at all, offline dashboard signage for screens without logins removes the login problem completely, and our shop-floor screens play offline content with no PC and no account.

Questions